Debian Security Vulnerabilities (CVEs)

This Linux kernel vulnerability allows local users to escalate privileges by exploiting a uid mapping bug in OverlayFS when copying capable files betw...

This CVE describes a use-after-free vulnerability in Xen's shadow mode with log-dirty mode enabled. It allows a malicious guest VM to crash the hyperv...

This CVE describes a denial-of-service vulnerability in Rack's multipart MIME parsing code. Attackers can craft malicious requests that cause excessiv...

CVE-2023-27635 is a command injection vulnerability in debmany (part of debian-goodies) that allows attackers to execute arbitrary shell commands via ...

This vulnerability allows local privilege escalation when users run 'systemctl status' via Sudo in certain configurations. Attackers can escape from t...

This vulnerability is a heap buffer overflow in libde265's motion.cc component, allowing attackers to execute arbitrary code or cause denial of servic...

Apache Commons FileUpload before version 1.5 has a denial-of-service vulnerability where attackers can overwhelm systems by sending unlimited file upl...

This CVE describes a timing side-channel vulnerability in GnuTLS that allows attackers to perform Bleichenbacher-style attacks against RSA encryption....

This CVE describes a stack-based buffer overflow vulnerability in GPAC multimedia framework versions prior to 2.2. Attackers can exploit this by craft...

This CVE describes a ReDoS (Regular Expression Denial of Service) vulnerability in Ruby on Rails Action Dispatch. Attackers can send specially crafted...

This vulnerability in Django allows attackers to cause denial-of-service by sending HTTP requests with extremely large Accept-Language headers, which ...

CVE-2022-45188 is a heap-based buffer overflow vulnerability in Netatalk's afp_getappl function that allows remote code execution via a malicious .app...

CVE-2022-2598 is an out-of-bounds write vulnerability in Vim's API that could allow arbitrary code execution when processing specially crafted input. ...

CVE-2022-30287 is a reflection injection vulnerability in Horde Groupware Webmail Edition that allows attackers to instantiate driver classes and achi...

A flaw in LibreOffice's password storage system weakens encryption from 128-bit to 43-bit entropy, making stored web connection passwords vulnerable t...

CVE-2020-7677 is a remote code execution vulnerability in the thenify npm package where user-controlled input is passed directly to the eval() functio...

This vulnerability in libtirpc allows remote attackers to exhaust file descriptors by exploiting mishandled idle TCP connections, potentially causing ...

CVE-2022-1924 is an integer overflow vulnerability in the GStreamer multimedia framework's Matroska demuxer during LZO decompression. This can cause d...

This CVE describes an integer overflow vulnerability in the qtdemux element of GStreamer when processing zlib-compressed data. It can cause denial of ...

This CVE describes an integer overflow vulnerability in the matroskademux element of GStreamer's gst_matroska_demux_add_wvpk_header function. When par...

CVE-2022-1922 is an integer overflow vulnerability in GStreamer's Matroska demuxer that can cause denial of service or potential heap overwrite during...

LemonLDAP::NG versions through 2.0.8 do not validate X.509 certificates when connecting to LDAP backends by default, allowing man-in-the-middle attack...

This CVE describes an OS command injection vulnerability in Node.js that allows attackers to bypass host validation checks and perform DNS rebinding a...

CVE-2022-35414 is an uninitialized read vulnerability in QEMU's memory management component that can lead to crashes when handling I/O operations. Thi...

CVE-2022-35410 is a path traversal vulnerability in mat2 (metadata anonymization toolkit) that allows attackers to access sensitive files outside the ...

This vulnerability in Eclipse Jetty's HTTP/2 server implementation allows attackers to cause denial of service by sending invalid HTTP/2 requests that...

Guzzle PHP HTTP client versions before 6.5.8 and 7.4.5 leak Authorization headers during cross-origin redirects when using the cURL handler. This expo...

CVE-2022-31081 is an HTTP request smuggling vulnerability in HTTP::Daemon Perl library versions before 6.15. It allows attackers to bypass security co...

CVE-2022-31084 is an arbitrary object instantiation vulnerability in LDAP Account Manager (LAM) that allows attackers to inject constructor arguments ...

LDAP Account Manager versions before 8.0 contain a vulnerability where incorrect regular expressions allow uploading PHP scripts to the config/templat...

CVE-2022-2129 is an out-of-bounds write vulnerability in Vim text editor versions prior to 8.2. This allows attackers to execute arbitrary code by tri...

CVE-2022-2124 is a buffer over-read vulnerability in Vim text editor that allows reading beyond allocated memory boundaries. This affects users runnin...

CVE-2022-31291 is a double-free vulnerability in dlt-daemon's configuration file parser that allows attackers to cause memory corruption via crafted T...

This CVE describes a buffer overflow vulnerability in PHP's pdo_mysql extension with mysqlnd driver when connecting with an excessively long password....

CVE-2022-32278 is a remote code execution vulnerability in XFCE 4.16 where attackers can trick xdg-open into executing malicious .desktop files from a...

Guzzle HTTP client versions before 6.5.7 and 7.4.4 expose sensitive cookie information during HTTP redirects. When a request to an HTTPS server redire...

CVE-2022-2000 is an out-of-bounds write vulnerability in Vim text editor versions prior to 8.2. This allows attackers to execute arbitrary code by tri...

This vulnerability allows local attackers to gain root privileges on 3CX Phone System installations by exploiting insecure sudo permissions for tcpdum...

This vulnerability in the Linux kernel's netfilter component allows a local user with namespace creation privileges to escalate to root via a use-afte...

libcurl incorrectly reuses TLS/SSH connections when security settings have changed, potentially allowing sensitive data to be transmitted over less se...

This curl vulnerability allows information disclosure when an attacker can force curl to reuse an existing IPv6 connection from the pool with a differ...

CVE-2022-1968 is a use-after-free vulnerability in Vim text editor versions prior to 8.2. This allows attackers to execute arbitrary code by tricking ...